How to determine whether a python script is hostile?
os isn't the only module that provides functions to remove files from filesystem etc., shutils can be used for such evil things too. Or you could somehow shell-execute system commands to do so.

Module imports can even be camouflaged like this:

evil_module = __import__(chr(int("".join(map(lambda x: str(x), [1]*3)))) + '\x73')


So you won't immediately know what it actually imports (os module in this case).

What is to be seen malicious also depends on your view. Like with any trojan, virus or whatever, they don't necessarily damange your system or delete things. A python script could open a network connection and send spam mails, or transmit information about your machine to an attacker.

There are many possibilities to abuse python, and bpy makes it rather worse - bpy.ops.wm.url_open(url="...") could be used to open a prepared website, that infects you with a drive-by download.

The best protection is it run scripts from trusted sources only.